From 54dff19a69d5bc1ec5816fb44bba9c8329f3c03b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robin=20Br=C3=A4mer?=
 <22003767+robinbraemer@users.noreply.github.com>
Date: Mon, 10 Aug 2026 11:11:31 +0200
Subject: [PATCH 1/2] ci: migrate Linux x64 jobs to AgentOS ARC

---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/release.yml | 4 ++--
 CONTRIBUTING.md               | 5 +++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4ffec2f5..50f593d1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   check:
     name: check
-    runs-on: ubuntu-24.04
+    runs-on: akua-docker-ci-v2
     timeout-minutes: 20
     steps:
       - name: Check out the exact revision
@@ -54,7 +54,7 @@ jobs:
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository
     needs: check
-    runs-on: ubuntu-24.04
+    runs-on: akua-x64-ci-v2
     timeout-minutes: 40
     steps:
       - name: Check out the exact revision
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 380eda61..56f4745a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - runner: akua-docker-ci-v2
             platform: linux/amd64
             suffix: amd64
           - runner: ubuntu-24.04-arm
@@ -70,7 +70,7 @@ jobs:
   publish:
     name: publish immutable release
     needs: image
-    runs-on: ubuntu-24.04
+    runs-on: akua-docker-ci-v2
     timeout-minutes: 20
     steps:
       - name: Check out the released revision
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d242ff08..611efddf 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -313,8 +313,9 @@ git push origin v<semver>
 ```
 
 The [`Release`](./.github/workflows/release.yml) workflow builds the same clean
-tagged checkout on native GitHub-hosted amd64 and arm64 runners, publishes the
-two platform images, joins them into one OCI index, resolves its registry
+tagged checkout on the audited AgentOS ARC/Kata amd64 pool and a native
+GitHub-hosted arm64 runner, publishes the two platform images, joins them into
+one OCI index, resolves its registry
 digest, and renders the ordinary human-readable block YAML directly from
 Kustomize. It uploads the fixed-name scoped, cluster-admin and database
 manifests to a draft GitHub release and publishes the release only after every

From 41662784137b525c7e70ab0a43da43da942decf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robin=20Br=C3=A4mer?=
 <22003767+robinbraemer@users.noreply.github.com>
Date: Mon, 10 Aug 2026 12:58:57 +0200
Subject: [PATCH 2/2] ci: share runner temp with DinD

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 50f593d1..62de3532 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,8 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Run repository checks
+        env:
+          TMPDIR: ${{ runner.temp }}
         run: bun run check
 
       - name: Build the Cloudflare Worker